Encryption with just a passphrase?

jarhead

Cadet
Joined
Dec 9, 2017
Messages
2
Is it possible to use encryption with JUST a passphrase? I am very good at remembering passwords and I would feel my data is much safer if I knew that if anything happened to my boot drive or the key backup, I could always unlock my volume by entering just the passphrase.. requiring BOTH a key and a passphrase seems weird to me, and risky.
 

Chris Moore

Hall of Famer
Joined
May 2, 2015
Messages
10,080
Is it possible to use encryption with JUST a passphrase? I am very good at remembering passwords and I would feel my data is much safer if I knew that if anything happened to my boot drive or the key backup, I could always unlock my volume by entering just the passphrase.. requiring BOTH a key and a passphrase seems weird to me, and risky.
It isn't weird, it is more secure, because there is no amount of guessing that will ever give someone the key, where someone might eventually guess your password by brute force if the data was only protected by a password.

You are correct that it is risky. There are users of the Forum that have lost access to their data due to something as simple as replacing a disk in the pool and not properly updating the key and downloading it. If you are not extremely cautious, encryption will permanently deny access to the data and that is how it is meant to be. It is intended to be secure.

If you don't have some regulation that requires your data to be encrypted, it is (in my view) not worth the risk. It is a risk, but it is like one of the computer systems I access at work. It requires a login name, password, pin and a code generated by a hardware key. Four items that all have to be entered correctly or you don't get in and if you enter them wrong three times, you are locked out. Secure, but a big pain. This is like that, but worse because if you lose the key file or forget the password, you will never be able to regain access to the data.
 

Ericloewe

Server Wrangler
Moderator
Joined
Feb 15, 2014
Messages
20,061
Let me explain why just a password is not an option:

The keys used for encryption need a decent amount of entropy and they're long. This is simply not feasible with anything resembling a password. That's why keys are derived from passwords using key derivation functions.

You could memorize the key, but I don't think you'll enjoy memorizing 128-256 random bits, even in hex.
 

jarhead

Cadet
Joined
Dec 9, 2017
Messages
2
Thanks for all your replies and the explanation why! I understand now. I will just obsessively backup keys every now and then. :)
 

Chris Moore

Hall of Famer
Joined
May 2, 2015
Messages
10,080
Thanks for all your replies and the explanation why! I understand now. I will just obsessively backup keys every now and then. :)
You need both the key and the recovery key. Depending on the circumstances, it will want one or the other, so you need them both. If you make a change, like replacement of a failed drive, you need to rekey the pool and download them both again.

Sent from my SAMSUNG-SGH-I537 using Tapatalk
 

EsTaF

Contributor
Joined
Sep 20, 2013
Messages
163
Let me explain why just a password is not an option:

The keys used for encryption need a decent amount of entropy and they're long. This is simply not feasible with anything resembling a password. That's why keys are derived from passwords using key derivation functions.

You could memorize the key, but I don't think you'll enjoy memorizing 128-256 random bits, even in hex.

For example>
You have two machines. FreeNAS and any client OS.
You have encrypted disks on freenas with your "128-256 random bits superkey".
Somebody steal these two machines.
He is running freenas and client machine and just go to smb resource with your docs.
Just somebody in your family remember smb pass and check option "save smb pass" (client side).
Anyway, that variant have potential risks. This is a "microsoft way". With their superkeys etc, but when intruder go over the front door.
I guess I'll have add linux/bsd with luks/veracrypt one. was very surprised of freenas' sec variant.
 
Last edited:

danb35

Hall of Famer
Joined
Aug 16, 2011
Messages
15,298

EsTaF

Contributor
Joined
Sep 20, 2013
Messages
163
Then, all keys, that you use for freenas, must be as 128-256 random one. For freenas, for smb way to freenas/web etc. Otherwise there is no sense.
 

Ericloewe

Server Wrangler
Moderator
Joined
Feb 15, 2014
Messages
20,061
Your view is somewhat simplistic and doesn't distinguish authentication from encryption.

Encryption has to stand up against an attacker that can do anything. Samba can just lock out a client that is trying way too many sets of credentials.
 

EsTaF

Contributor
Joined
Sep 20, 2013
Messages
163
authentication vs encryption. warm vs soft. ok.
Attacker can just have freenas machine + client computers, with saved passwords of smb/nfs/etc on such client pc.
I would understand that way, if be freenas ask that key every time, when you're powering up/restart machine (at least). People must guess, how to solve that moment.
And there is we watch a moment as in ms windows' demotivator, when a door have 100 superlocks but not have a simple wall.
 
Last edited:

EsTaF

Contributor
Joined
Sep 20, 2013
Messages
163
Perhaps, I don't understand a self-study philosophy. Perhaps I'm lazy man a look like as some evil "consumer". The water walkers etc. But any manual must have the simplest instruction. The road map, how to make something securely. The bare minimum.
And no so - "FreeNAS® encryption is different from the encryption used in Oracle’s proprietary, non-open source version of ZFS." etc. https://ixsystems.com/documentation/freenas/11.2/storage.html
Never made any sense to user, who will use that mechanism. Or "Data in memory, including ARC, is not encrypted. ZFS data on disk, including ZIL and SLOG, are encrypted if the underlying disks are encrypted. Swap data on disk is always encrypted.".
The people, who can guess all it, take freebsd (and not freenas) and make all there. Or (generally), take any Linux and install luks/veracrypt one. If there is such "That, my dear user, you can work out for yourself, how to right secure your data", game.
 
Last edited:

Ericloewe

Server Wrangler
Moderator
Joined
Feb 15, 2014
Messages
20,061
What are you complaining about, exactly? That users are inherently a security risk? That's not news and FreeNAS does not have magic tools to solve all problems that causes
 

EsTaF

Contributor
Joined
Sep 20, 2013
Messages
163
For example - how don't hold keyfile on runned freenas and give it on boot moment only. For some people will be easy to eat a back of rocks, than to have found it. And on FreeNAS docs people writing about "Data in memory, including ARC, is not encrypted. ZFS data on disk, including ZIL and SLOG, are encrypted if the underlying disks are encrypted. Swap data on disk is always encrypted.". one.
 

Ericloewe

Server Wrangler
Moderator
Joined
Feb 15, 2014
Messages
20,061
I cannot understand you at all. Perhaps one of the non-English forum sections might allow you to express your thoughts better.
 
Top